RE: [gentoo-hardened] emerge and setfiles

[Tad]

Thanks,

This was a good start, but it needed a few additions for it to work on my
system.

On my system the tty device is labeled with portage_tty_device_t instead of
portage_devpts_t. This is probably because /dev/pts does not appear to be
used for ttys. Also, setfiles_t was missing the tty grant.

-Tad

> -----Original Message-----
> From: Chris PeBenito [mailto:pebenito@g.o]
> Sent: Tuesday, November 25, 2003 7:44 AM
> To: Tad
> Cc: 'Hardened Gentoo Mail List'
> Subject: RE: [gentoo-hardened] emerge and setfiles
>
> On Tue, 2003-11-25 at 01:02, Tad wrote:
> > There are no denial messages. From the root:portage_r:portage_t read and
>
> > I can see nothing wrong so this is really perplexing.
> > What is especially odd is the lack of denial messages.
>
> Well this was a sneaky bug.  Only people that change to portage_r would
> see this.  The problem was that portage_t could transition to
> setfiles_t, but portage_r could not have the setfiles_t type.  If you
> use the sysadm_t auto-transition, which most people seem to do, the role
> stays as sysadm_r, which was allowed setfiles_t, and thus wouldn't run
> into this problem.  Please try adding on this patch, it should fix it.
>
> cd /etc/security/selinux/src/policy
> patch -p1 < /path/to/selinux-base-policy-20031010-r1-portage_r-types.diff
>
> --
> Chris PeBenito
> <pebenito@g.o>
> Developer,
> Hardened Gentoo Linux
> Embedded Gentoo Linux
>
> Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
> Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243


--
gentoo-hardened@g.o mailing list